Account takeover of verified listers in Classifieds marketplaces

How the attack works

1. The attacker targets the sign-in route for an established lister account, seeking access to a profile that already carries verification or a credible posting history.
2. Stolen credentials are tried through automated requests spread across sessions and networks, obscuring the repeated pattern from checks focused on one address.
3. A successful login from an unfamiliar client gives the attacker access to the lister’s permitted posting or account-management actions.
4. The compromised profile publishes misleading adverts or changes contact information, using its existing reputation to make the new activity appear credible to potential respondents.
5. The legitimate lister or an affected user reports the change, leaving the platform to establish the access sequence and identify which adverts need review.

Why it gets through

Verification and a history of genuine adverts make a lister more credible to users who know little about the person behind a listing. An attacker values that reputation precisely because it can reduce suspicion. Taking over an established account allows new abuse to appear under signals earned by someone else, rather than beginning with a profile that has no history.

Login and advert reviews often happen separately. Authentication records show access, while moderation focuses on listings and reports. Without the surrounding session evidence, a compromised account can appear to be a familiar lister posting again, even when its device context has changed.

A device change is not conclusive on its own. Genuine listers replace phones, travel or share responsibility for a business account. The useful question is whether the new access fits with the requests and account activity around it. That requires context beyond a country, device label or a successful password check, without pretending those signals establish the user’s identity.

The affected listing count defines how much published content needs review after a trusted account is compromised. Property, vehicle or job adverts may have been changed or added before anyone reports the access problem. Moderators must establish which listings and related conversations need attention, rather than assuming that restoring the profile also resolves every action taken through it.

Time to restore legitimate access matters to a lister whose business depends on receiving and answering enquiries. Recovery may require ownership checks, corrections to adverts and coordination between support and security. The longer that process continues, the longer an honest business can remain unable to use an account it has already invested time in establishing.

Account-recovery ticket volume captures the service burden around the compromise, including follow-up questions after access returns. A credible posting history can complicate decisions about restrictions and reinstatement. Review those tickets alongside the affected listings and the account’s access history, so the response addresses what happened during the incident rather than treating a password reset as the whole resolution.